refactor(settings): adopt environment-only runtime secret flow

packages/api/src/router/assistant-tools.ts

@@ -76,12 +76,14 @@ import { insightsRouter } from "./insights.js";
 import { scenarioRouter } from "./scenario.js";
 import { allocationRouter } from "./allocation.js";
 import { staffingRouter } from "./staffing.js";
+import { resolveSystemSettingsRuntime } from "../lib/system-settings-runtime.js";
 
 // ─── Mutation tool set for audit logging (EGAI 4.1.3.1 / IAAI 3.6.26) ──────
 
 export const MUTATION_TOOLS = new Set([
   "import_csv_data",
   "update_system_settings",
+  "clear_stored_runtime_secrets",
   "test_ai_connection",
   "test_smtp_connection",
   "test_gemini_connection",
@@ -4772,14 +4774,13 @@ export const TOOL_DEFINITIONS: ToolDef[] = [
     type: "function",
     function: {
       name: "update_system_settings",
-      description: "Update system settings through the real settings router. Admin role required. Always confirm first.",
+      description: "Update non-secret system settings through the real settings router. Runtime secrets must be provisioned via deployment environment or secret manager. Admin role required. Always confirm first.",
       parameters: {
         type: "object",
         properties: {
           aiProvider: { type: "string", enum: ["openai", "azure"] },
           azureOpenAiEndpoint: { type: "string" },
           azureOpenAiDeployment: { type: "string" },
-          azureOpenAiApiKey: { type: "string" },
           azureApiVersion: { type: "string" },
           aiMaxCompletionTokens: { type: "integer" },
           aiTemperature: { type: "number" },
@@ -4789,17 +4790,13 @@ export const TOOL_DEFINITIONS: ToolDef[] = [
           smtpHost: { type: "string" },
           smtpPort: { type: "integer" },
           smtpUser: { type: "string" },
-          smtpPassword: { type: "string" },
           smtpFrom: { type: "string" },
           smtpTls: { type: "boolean" },
           anonymizationEnabled: { type: "boolean" },
           anonymizationDomain: { type: "string" },
-          anonymizationSeed: { type: "string" },
           anonymizationMode: { type: "string", enum: ["global"] },
           azureDalleDeployment: { type: "string" },
           azureDalleEndpoint: { type: "string" },
-          azureDalleApiKey: { type: "string" },
-          geminiApiKey: { type: "string" },
           geminiModel: { type: "string" },
           imageProvider: { type: "string", enum: ["dalle", "gemini"] },
           vacationDefaultDays: { type: "integer" },
@@ -4809,6 +4806,17 @@ export const TOOL_DEFINITIONS: ToolDef[] = [
     },
   },
   {
+  {
+    type: "function",
+    function: {
+      name: "clear_stored_runtime_secrets",
+      description: "Clear legacy database-stored runtime secrets after they have been migrated to deployment secret management. Admin role required. Always confirm first.",
+      parameters: {
+        type: "object",
+        properties: {},
+      },
+    },
+  },
     type: "function",
     function: {
       name: "test_ai_connection",
@@ -9306,7 +9314,6 @@ const executors = {
     aiProvider?: "openai" | "azure";
     azureOpenAiEndpoint?: string;
     azureOpenAiDeployment?: string;
-    azureOpenAiApiKey?: string;
     azureApiVersion?: string;
     aiMaxCompletionTokens?: number;
     aiTemperature?: number;
@@ -9322,17 +9329,13 @@ const executors = {
     smtpHost?: string;
     smtpPort?: number;
     smtpUser?: string;
-    smtpPassword?: string;
     smtpFrom?: string;
     smtpTls?: boolean;
     anonymizationEnabled?: boolean;
     anonymizationDomain?: string;
-    anonymizationSeed?: string;
     anonymizationMode?: "global";
     azureDalleDeployment?: string;
     azureDalleEndpoint?: string;
-    azureDalleApiKey?: string;
-    geminiApiKey?: string;
     geminiModel?: string;
     imageProvider?: "dalle" | "gemini";
     vacationDefaultDays?: number;
@@ -9342,6 +9345,11 @@ const executors = {
     return caller.updateSystemSettings(params);
   },
 
+  async clear_stored_runtime_secrets(_params: Record<string, never>, ctx: ToolContext) {
+    const caller = createSettingsCaller(createScopedCallerContext(ctx));
+    return caller.clearStoredRuntimeSecrets();
+  },
+
   async test_ai_connection(_params: Record<string, never>, ctx: ToolContext) {
     const caller = createSettingsCaller(createScopedCallerContext(ctx));
     return caller.testAiConnection();
@@ -9358,7 +9366,7 @@ const executors = {
   },
 
   async get_ai_configured(_params: Record<string, never>, ctx: ToolContext) {
-    const settings = await ctx.db.systemSettings.findUnique({
+    const settings = resolveSystemSettingsRuntime(await ctx.db.systemSettings.findUnique({
       where: { id: "singleton" },
       select: {
         aiProvider: true,
@@ -9366,7 +9374,7 @@ const executors = {
         azureOpenAiDeployment: true,
         azureOpenAiApiKey: true,
       },
-    });
+    }));
     return { configured: isAiConfigured(settings) };
   },